← Back to browse · API

CVE-2019-20500

Severity
HIGH
CVSS
7.8
EPSS
0.97109
Risk score
58.99
CISA KEV
Yes
PoC
No
Published
2020-03-05
Modified
2025-10-21
First seen
2026-08-07
Aliases
EUVD-2019-11044, GHSA-XX29-P5F4-MWR8
Products
D-Link:DWL-2600AP Access Point, n/a:n/a n/a
Sources
cisa.gov CVE-2019-20500
euvd EUVD-2019-11044

Description

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.

References